Add libcurl as an alternative http client

Bazel's repository downloader is built on the JDK HTTP/TLS stack. That path uses the JVM trust store, not the OS trust store that `curl`, `wget`, and browsers already honor. Corporate TLS inspection, custom CAs under `/etc/pki` or the macOS keychain, and HTTPS proxies therefore fail with:
```
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
```
The same URLs succeed with `curl`. Workarounds (`javax.net.ssl.trustStore`, `BAZEL_USE_SYSTEM_CERTS`, importing CAs into the embedded JDK) are per-machine, easy to get wrong, and still miss cases.

Can bazel add **libcurl as an optional HTTP client** for repository and registry downloads (`http_archive`, `ctx.download*`, Bzlmod). Keep the JDK client as default; select curl via a flag, e.g. `--experimental_http_client=curl`.

libcurl would pick up the platform TLS stack (OpenSSL / Secure Transport / SChannel), system roots, `SSL_CERT_FILE` / `CURL_CA_BUNDLE`, `http(s)_proxy`, and mTLS client certs. Behavior would then match the tools operators already use to debug fetches.

## Related issues

These are the same TLS/trust-store mismatch, not isolated JDK bugs:

- #29751 — no repo-wide way for the downloader to trust system roots
- #26814 — custom CA under `/etc/pki` still ignored
- #16915 — PKIX failure behind an HTTPS proxy
- #16223 — Java downloader ignores system cacerts
- #25814 — request to disable SSL verification (a symptom of the same gap)

### Which category does this issue belong to?

Core

### What underlying problem are you trying to solve with this feature?

_No response_

### Which operating system are you running Bazel on?

_No response_

### What is the output of `bazel info release`?

_No response_

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

```text

```

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

_No response_

Start by tracing Bazel's repository downloader and its current JDK HTTP/TLS path, including repository and registry download callers such as http_archive, ctx.download*, and Bzlmod. Define the optional curl selection and compatibility behavior, then validate system certificates, proxies, and client certificates while preserving the JDK client as default.

Written by the indexing model from the issue text.